General MoBlock thread

[belgofac]

Hi JRE, All,

I have been running Moblock for a while on Linux Mint Daryna but new distro Mint Elyssa (Hardy based) = new problems.
I use Firestarter as firewall.

I installed Moblock and it worked straight out of the box. For a while. I had to adjust moblock.conf and used the same settings as before.
Then moblock did not want to start at all anymore.

Status:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       192.168.0.1          0.0.0.0/0           tcp flags:!0x17/0x02 
   35  7185 ACCEPT     udp  --  *      *       192.168.0.1          0.0.0.0/0           
   60  2520 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 limit: avg 1/sec burst 5 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 0 limit: avg 1/sec burst 5 
    0     0 LSI        udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:33434 
    0     0 LSI        icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            255.255.255.255     
   10  2505 DROP       all  --  *      *       0.0.0.0/0            192.168.0.255       
    0     0 DROP       all  --  *      *       224.0.0.0/8          0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/8         
    0     0 DROP       all  --  *      *       255.255.255.255      0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0             
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 LSI        all  -f  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 10/min burst 5 
  602  522K INBOUND    all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG_FILTER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `Unknown Input' 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 limit: avg 1/sec burst 5 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 0 limit: avg 1/sec burst 5 
    0     0 LSI        udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:33434 
    0     0 LSI        icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG_FILTER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `Unknown Forward' 

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       192.168.0.2          192.168.0.1         tcp dpt:53 
   41  2545 ACCEPT     udp  --  *      *       192.168.0.2          192.168.0.1         udp dpt:53 
   60  2520 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       224.0.0.0/8          0.0.0.0/0           
    2   136 DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/8         
    0     0 DROP       all  --  *      *       255.255.255.255      0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0             
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
  574 44221 OUTBOUND   all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 LOG_FILTER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `Unknown Output' 

Chain INBOUND (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  602  522K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 LSI        all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LOG_FILTER (5 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain LSI (6 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG_FILTER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `Inbound ' 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x04 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `Inbound ' 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x04 
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `Inbound ' 
    0     0 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 5/sec burst 5 LOG flags 0 level 6 prefix `Inbound ' 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LSO (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG_FILTER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 5/sec burst 5 LOG flags 0 level 6 prefix `Outbound ' 
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 

Chain OUTBOUND (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
  518 39692 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
   56  4529 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain moblock_fw (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           NFQUEUE num 0

Chain moblock_in (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  *      *       64.15.112.0          0.0.0.0/0           
    0     0 RETURN     all  --  *      *       192.168.0.0/16       0.0.0.0/0           
    0     0 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           NFQUEUE num 0

Chain moblock_out (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           NFQUEUE num 0

Please check if the above printed iptables rules are correct!

 * moblock is not running.

Moblock-control.log:

[sudo] password for eddy: 
YAHOOZ-060921002953:75.35.59.144-75.35.59.151
YAHOOZ-061003013011:75.41.158.152-75.41.158.159
YAHOOZ-070828170428:76.246.182.152-76.246.182.159
Installing blocklist to /etc/moblock/guarding.p2p                        [ OK ]
 * MoBlock is not running.
2008-06-07 10:44:00 EST End: moblock-control update
2008-06-07 10:44:16 EST Begin: moblock-control start
Inserting iptablesiptables v1.3.8: host/network `-' not found
Try `iptables -h' or 'iptables --help' for more information.
                                                                         [fail]
2008-06-07 11:00:23 EST Begin: moblock-control reload
Building blocklist                                                       [ OK ]
Removing lines containing the following regular expressions from the blocklist:
google
yahoo
altavista
debian
sourceforge
Removed the following lines:
add2.dir.scd.yahoo.com ads:66.218.70.227-66.218.70.227
BOGDAN_LUCIAN_CRISTIAN-YAHOOCOM:208.98.12.0-208.98.12.63
Cuyahooga County Bar Assoc:66.73.60.72-66.73.60.79
extads1.vip.ukl.yahoo.com ads:217.12.4.96-217.12.4.96
gigenfu@yahoo.com.tw:218.210.18.64-218.210.18.71
GOOGLE-NL:213.19.160.192-213.19.160.207
GOOGLE/PLANET LABS:208.185.40.192-208.185.40.223
GOOGLE/PLANET LABS:208.185.4.128-208.185.4.159
GOOGLE/PLANET LABS:208.185.42.96-208.185.42.127
NTT Com/SOL/VTF/EH/Sony/Google:157.238.217.32-157.238.217.39
rd1.vip.ukl.yahoo.com ads:217.12.6.21-217.12.6.21
Savvis-Sourceforge Split1 Start Range:66.35.192.0-66.35.249.255
Savvis Sourceforge Split2 End Range:66.35.251.0-66.35.255.255
sexymagnet.com/p2w1.geo.scd.yahoo.com]:66.218.79.157-66.218.79.157
SNET TEST YAHOO 01:66.159.160.136-66.159.160.143
SNET TEST YAHOO 02:66.159.160.144-66.159.160.151
SNET TEST YAHOO 03:66.159.160.152-66.159.160.159
SNET TEST YAHOO 04:66.159.160.160-66.159.160.167
SNET TEST YAHOO 05:66.159.160.168-66.159.160.183
SNET TEST YAHOO 06:66.159.160.184-66.159.160.191
SNET TEST YAHOO 07:66.159.160.192-66.159.160.199
SNET TEST YAHOO 09:66.159.160.208-66.159.160.215
SNET TEST YAHOO 10:66.159.160.216-66.159.160.223
SNET TEST YAHOO 11:66.159.160.224-66.159.160.231
SNET TEST YAHOO 3004:64.252.30.112-64.252.30.119
SNET TEST YAHOO:64.252.30.80-64.252.30.111
SNET TEST YAHOO:66.159.160.200-66.159.160.207
SNET TEST YAHOO:66.159.160.232-66.159.160.255
SNET TEST YAHOO:66.159.160.32-66.159.160.39
SNET TEST YAHOO:66.159.160.8-66.159.160.23
SNET TEST YAHOO:66.159.185.0-66.159.185.47
Software in the Public Interest / Debian:194.109.137.216-194.109.137.223
Taiwan Yahoo Electric Co., Ltd:203.74.105.88-203.74.105.95
Tonghua Yahoo Netbar,Kuaida Town  , Tonghua City,:218.62.120.236-218.62.120.239
Tor.debian40etch64minim:88.198.17.116-88.198.17.116
tsaisuntech@yahoo.com:220.228.117.128-220.228.117.135
yahoo fraud scammer:68.195.62.40-68.195.62.40
YAHOOPC:218.233.116.192-218.233.116.255
yahoo scammer:4.65.105.109-4.65.105.109
Yahoo Software Development India Pvt. Ltd:203.145.181.48-203.145.181.63
YAHOOZ-060921002953:75.35.59.144-75.35.59.151
YAHOOZ-061003013011:75.41.158.152-75.41.158.159
YAHOOZ-070828170428:76.246.182.152-76.246.182.159
Installing blocklist to /etc/moblock/guarding.p2p                        [ OK ]
 * MoBlock is not running.
2008-06-07 11:00:33 EST End: moblock-control reload
2008-06-07 11:00:54 EST Begin: moblock-control restart
Deleting iptablesiptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: Bad rule (does a matching rule exist in that chain?)
 * Some iptables rules could not be deleted. The most common reason for this is
 * that they did not exist. If MoBlock was not running this is the correct
 * behaviour. But if MoBlock was running there is some problem. Make sure that
 * MoBlock inserts its iptables rules correctly and that other software, e.g.
 * firewall applications, don't delete them. Make sure that MoBlock is started
 * after other firewall applications.
Stopping MoBlock                                                         [fail]
Inserting iptablesiptables v1.3.8: host/network `-' not found
Try `iptables -h' or 'iptables --help' for more information.

I have tried to delete and re-install but that didn't work either.

I have ben fiddling a bit more and it looks like the remove and re-install did not work properly:

[sudo] password for eddy: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 17 not upgraded.
Need to get 0B/59.6kB of archives.
After this operation, 0B of additional disk space will be used.
Do you want to continue [Y/n]? y
(Reading database ... 87966 files and directories currently installed.)
Preparing to replace moblock 0.9~rc2-11~hardy (using .../moblock_0.9~rc2-11~hardy_i386.deb) ...
 * Stopping MoBlock moblock                                              [fail] 
invoke-rc.d: initscript moblock, action "stop" failed.
dpkg: warning - old pre-removal script returned error exit status 3
dpkg - trying script from the new package instead ...
 * Stopping MoBlock moblock                                              [fail] 
invoke-rc.d: initscript moblock, action "stop" failed.
dpkg: error processing /var/cache/apt/archives/moblock_0.9~rc2-11~hardy_i386.deb (--unpack):
 subprocess new pre-removal script returned error exit status 3
 * Starting MoBlock moblock                                                     invoke-rc.d: initscript moblock, action "start" failed.
dpkg: error while cleaning up:
 subprocess post-installation script returned error exit status 8
Errors were encountered while processing:
 /var/cache/apt/archives/moblock_0.9~rc2-11~hardy_i386.deb
E: Sub-process /usr/bin/dpkg returned an error code

So, I can not uninstall or re-install it.

Tried a apt-get -f install but the same thing:

eddy@eddy-mint2 ~ $ sudo apt-get -f install
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Correcting dependencies... Done
The following extra packages will be installed:
  libnetfilter-queue1 libnfnetlink0
The following NEW packages will be installed:
  libnetfilter-queue1 libnfnetlink0
0 upgraded, 2 newly installed, 0 to remove and 17 not upgraded.
1 not fully installed or removed.
Need to get 0B/78.9kB of archives.
After this operation, 139kB of additional disk space will be used.
Do you want to continue [Y/n]? y
Selecting previously deselected package libnfnetlink0.
(Reading database ... 87954 files and directories currently installed.)
Unpacking libnfnetlink0 (from .../libnfnetlink0_0.0.30-2_i386.deb) ...
Selecting previously deselected package libnetfilter-queue1.
Unpacking libnetfilter-queue1 (from .../libnetfilter-queue1_0.0.13-1_i386.deb) ...
Selecting previously deselected package moblock.
Preparing to replace moblock 0.9~rc2-11~hardy (using .../moblock_0.9~rc2-11~hardy_i386.deb) ...
 * Stopping MoBlock moblock                                              [fail] 
invoke-rc.d: initscript moblock, action "stop" failed.
dpkg: warning - old pre-removal script returned error exit status 3
dpkg - trying script from the new package instead ...
 * Stopping MoBlock moblock                                              [fail] 
invoke-rc.d: initscript moblock, action "stop" failed.
dpkg: error processing /var/cache/apt/archives/moblock_0.9~rc2-11~hardy_i386.deb (--unpack):
 subprocess new pre-removal script returned error exit status 3
 * Starting MoBlock moblock                                                     invoke-rc.d: initscript moblock, action "start" failed.
dpkg: error while cleaning up:
 subprocess post-installation script returned error exit status 8
Errors were encountered while processing:
 /var/cache/apt/archives/moblock_0.9~rc2-11~hardy_i386.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

Any idea?

[Sef]

Moved to Debian: Other OS talk.

[Doctoxic]

I guess you need to whitelist your LAN, including your router, too. If you don't know your local IP check it with "sudo ifconfig". It's the value after "inet addr:" of the interface that you use for networking. For wired connections that might be "eth0", for wireless connections "wlan0".

Example: You found out that your IP is 192.168.0.39. Then your LAN will most probably cover the IP range 192.168.0.1-192.168.0.255. Then whitelist this range with the following lines in /etc/default/moblock:

WHITE_IP_IN="192.168.0.0/24"
WHITE_IP_OUT="192.168.0.0/24"

After editing and a "moblock-control restart" you should be fine. Of course you can also do this with mobloquer.

firestarter is not a firewall itself but it just sets up the Linux firewall: iptables. All your iptables rules do belong to moblock, so there is no conflict.

Thanks for posting your iptables rules, that saved me some questions.

Greets
jre

thanks very much jre - thats sorted it

did i miss something in the readme or was this info missing (or maybe not written for a non linux expert?) Seems it would save you a lot of time if the readme's were aimed more at us noobs

i had previously tried mobloquer - it just didn't work (odd because it used to before i upgraded to Heron)

does running the firestarter gui activate the firewall? - only it started blocking my bittorrent port - easily fixed but annoying (sorry i know firestarter is not what you're supporting her)

Doc

[belgofac]

Do not worry about it anymore.

For others who run into the same uninstall problems posted and tried everything to uninstall moblock without success:

rm -rf everything to do with moblock like /etc/moblock etc...

You will get a message at boot telling you to click "fix broken packages" but that didn't work either so just continue with the boot.

I installed Ipblock instead without any problems.

I still have moblock running with Mint Daryna, so thanks for all your work guys.

[jre]

Moved to Debian: Other OS talk.

No, that's definitely the wrong forum. This thread is targeted at Ubuntu users like the HOWTO https://help.ubuntu.com/community/MoBlock.
It's there so that Ubuntu users can ask me questions and make development questions. (Yes, I'm a Debian user, but this has nothing to do with this thread).
I'm not sure if the network forum was well chosen, so move it wherever you think is correct. Thanks for your work.

Edit 2008-06-11: We were moved to
Ubuntu Forums > The Ubuntu Forum Community > Other Community Discussions > Tutorials & Tips
Thanks, Sef

did i miss something in the readme or was this info missing (or maybe not written for a non linux expert?) Seems it would save you a lot of time if the readme's were aimed more at us noobs

Where did you read? I'm currently working on improving the documentation on two places:

- debconf questions: they interact with the user during installation, give warnings, explanations and allow to configure moblock. If you want to help me please download the current preview package from moblock-deb.sf.net/preview/ and tell me if my language there is clear and helpful for a non-tech person. This would be a great help!

- the wiki at https://help.ubuntu.com/community/MoBlock

does running the firestarter gui activate the firewall? - only it started blocking my bittorrent port - easily fixed but annoying (sorry i know firestarter is not what you're supporting her)

If you "start" firestarter the configured iptables rules will be inserted. So just check with "iptables -L -nv" before and after starting firestarter what happens.

[Doctoxic]

thanks jre

i read the wiki - which does not contain the info in your post (well not specific enough for the likes of me)

thanks again for all your help with this

doc

[jre]

thanks jre

i read the wiki - which does not contain the info in your post (well not specific enough for the likes of me)

thanks again for all your help with this

Now it does. If you miss something please tell me.
jre

[yipperzz]

Getting an error when trying to stop the service. It says fail. But if I try to restart it works fine.

xxx@xxx:~$ sudo moblock-control stop
 * Stopping MoBlock moblock                                              [fail] 

xxx@xxx:~$ sudo moblock-control status
Current iptables rules (this may take awhile):

Chain INPUT (policy ACCEPT 12380 packets, 14M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 8134 packets, 555K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Please check if the above printed iptables rules are correct!

 * moblock is running, pid is 5430.

So it looks like it's running, I believe. But why can't it stop? Is there anything I need to look at?

Also if I kill pid 5430 and do a start command, it says that it's starting but when I give it a few minutes and run status it says that moblock is not running. Same for restart.

And is there a way to view what is being blocked real time? Or do you have to just go through the logs? Or would I need mobloquer? Just wondering as I'm going from peerguardian on XP and would like to get something running on my Linux box. Sorry if the questions. I didn't see much documentation on the website other than how to install moblock. Thanks for your help.

Edit: I just saw the tail -f /var/log/moblock.log command to view real time. But it's not working at the moment since moblock isn't running
Edit2: FYI I'm not running any software firewall.

[yipperzz]

Well now that I had a chance to reboot, moblock isn't running anymore when I check the status. If I try to start or restart, it still won't run.

Edit: I got it to work. I edited the moblock.conf file incorrectly. I thought that it said that you could put the ip range in the whitelist, So I did 192.168.11.1-192.168.11.255. I changed it to 192.168.11.0/24 and it's working now. Also, I may have added a space in that range too. I don't remember it since I changed it. Now it's working as it should. Sorry about that.

[jre]

Edit: I got it to work. I edited the moblock.conf file incorrectly. I thought that it said that you could put the ip range in the whitelist, So I did 192.168.11.1-192.168.11.255. I changed it to 192.168.11.0/24 and it's working now. Also, I may have added a space in that range too. I don't remember it since I changed it. Now it's working as it should. Sorry about that.

Glad to hear it's working now. For future reference: Have a look at /var/log/moblock-control.log, there errors get explained or at least logged.


For all who are interested:
I've put preview packages at moblock-deb.sf.net/preview with some nice new things:
- allow-list with support for ip-ranges (as yipperzz thought)
- debconf support (graphical configuration during installation and at every later time)
- log to syslog the port a blocked packet was sent on
- automatic whitelisting of the LAN

I'd appreciate every feedback. Next to bugreports (sigh ...) I'm particularly interested in feedback for the debconf part: is it useful? Do you understand it? Are there open questions? To technical?
If everything is perfect a short notice would be nice, too.

jre